RansomLook up to 2.0.0 Post Processing groupinfo improper authorization

Summaryinfo

A vulnerability classified as problematic was found in RansomLook up to 2.0.0. Impacted is the function groupinfo of the component Post Processing. The manipulation results in improper authorization. This vulnerability is cataloged as CVE-2026-78380. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in RansomLook up to 2.0.0. It has been classified as problematic. Affected is the function groupinfo of the component Post Processing. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. CVE summarizes:

RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private but does not verify whether the group or market to which the post belongs is configured as private. As a result, newly parsed victim information associated with a private group or market may be automatically published through enabled Rocket.Chat, Mastodon, Bluesky, and e-mail notification channels despite the entity being explicitly configured to prevent public disclosure. A similar issue affects the public MISP feed. The feed previously determined privacy using groupinfo(), which only queries the group database. Consequently, victim information associated with private markets could be added to the public MISP feed because the corresponding market privacy flag was not evaluated. An attacker or other unauthorized party able to access these public notification channels or the MISP feed may obtain victim information that was intended to remain private. Depending on the collected data, this may disclose victim names, ransomware activity, incident information, or other information associated with privately monitored groups and markets. The fix introduces a common is_private_entity() check covering both groups and markets and prevents private entity posts from being distributed through external notification channels or the public MISP feed. Internal storage and dashboard alerting remain unaffected.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-78380 since 08/24/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

Applying the patch 133cbeab3abdd64c22b02165c6505bb3e53698cc is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• RansomLook

Version

• 2.0

Website

• Product: https://github.com/RansomLook/RansomLook/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion